Separating fetching from building for better security

grothesque: > I naively assumed that rustup already installs everything that is needed for using the stdlib. As of recent nightly versions that is indeed the case. I added vendored dependencies for the standard library a couple of weeks ago.